f90baabc766cfad286ce325c235f28b0391171e857552f6319c306335be92d1d

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2ec94ee2cf410d8732bcc14d40d9b84.exe
Size

897KB
MD5

c2ec94ee2cf410d8732bcc14d40d9b84
SHA1

995469783baf3c0b1a98e951ae32f44a1f349d87
SHA256

f90baabc766cfad286ce325c235f28b0391171e857552f6319c306335be92d1d
SHA512

65c17a2c9d379bf08da4bab0289202fc11a8a35f4b624026698ec250d2adb4b8231d79933869ccd6eefa96deac48d6e36235ce58cffbf29b1859fe07fd50163b
SSDEEP

12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaXTo:YqDEvCTbMWu7rQYlBQcBiT6rprG8aDo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
2504	msedge.exe
2504	msedge.exe
4884	msedge.exe
4884	msedge.exe
3832	identity_helper.exe
3832	identity_helper.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4884	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	87
PID 2816 wrote to memory of 4884	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	87
PID 4884 wrote to memory of 2112	4884	msedge.exe	90
PID 4884 wrote to memory of 2112	4884	msedge.exe	90
PID 2816 wrote to memory of 3936	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	91
PID 2816 wrote to memory of 3936	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	91
PID 3936 wrote to memory of 3728	3936	msedge.exe	92
PID 3936 wrote to memory of 3728	3936	msedge.exe	92
PID 2816 wrote to memory of 1924	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	93
PID 2816 wrote to memory of 1924	2816	c2ec94ee2cf410d8732bcc14d40d9b84.exe	93
PID 1924 wrote to memory of 3356	1924	msedge.exe	94
PID 1924 wrote to memory of 3356	1924	msedge.exe	94
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3036	4884	msedge.exe	95
PID 4884 wrote to memory of 3956	4884	msedge.exe	96
PID 4884 wrote to memory of 3956	4884	msedge.exe	96
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97
PID 3936 wrote to memory of 3640	3936	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\c2ec94ee2cf410d8732bcc14d40d9b84.exe
"C:\Users\Admin\AppData\Local\Temp\c2ec94ee2cf410d8732bcc14d40d9b84.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037a46f8,0x7ff8037a4708,0x7ff8037a4718
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8945998608481026545,14707867896320288200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8037a46f8,0x7ff8037a4708,0x7ff8037a4718
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4984068436419137037,11841037049707973671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,4984068436419137037,11841037049707973671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037a46f8,0x7ff8037a4708,0x7ff8037a4718
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,12215697487929402751,6752763207085346923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
f8430b6d83479cb28f121e7f864e9b1c

SHA1
9161c686662358c34ca8fe62335480ec2d862eff

SHA256
a97a60f4da0c66c1de551f1c6c40eda3ad0ef7997543ccac0df5558fbca11240

SHA512
54a44b25c2200082ea4b07316f8e32b3fc16bd9e8f4f09cef6610d4eea79533629b892575cf9a2c258b530d4274478601291333560174f22836dc63f02b1110f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d9555fc7711192fa11de9c466e6a97f8

SHA1
b25d5022403e49f98b5c79e71f49fdaf1646720a

SHA256
a2162795a1570569250817b3399e3c2103370de1da0f741bd30df8ef24e89076

SHA512
43a97f3a4595cf9599cf542f04a254924b8fcb99bac64be5ce1bd391e5f47c84b5fe7309b778bcca7a3cbad13c8b2bfd61766dfd0955c0e8cbdeb39324e15083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d61dc03c6192420e0156103a2d89376e

SHA1
166d1cd69101b4822bca9ea6802ccdf2eccf203a

SHA256
bda62ebe3a9e3f1d1ead33c53d93d597171feb05c940283a4d510021000bc25b

SHA512
64611d24018c3c2d47030ce7a53472a1e970fd41a7ad2693d119193c015d8992dca951cb57285e444173eec3b11dce7c62c47259cac4f2a4db485dffbcabc39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4364fc4de4fa87d21778ee0caf1555ab

SHA1
0d274ec82df65b4012b919931106bc9b7752307c

SHA256
dc7f75e2ab33df75ef72acdc0eb87d139010b6ee3ac2618b8990e94b68104e68

SHA512
67270f505bede5c98d496aed2f18444e285ecd72aa0110272b7c91607662d3800fbf5f14a87cfe650433bc544fdffabe6510eab4ea5025f6a71fee9c6950597f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65beface49130bdf652dbb7127aacb2f

SHA1
b38cc4beb6c28ac74049b526940b58148351e72b

SHA256
9aeb0c37fd5e446ad36d3ddec168377dc9804a409c8ff0a02855c850508dcf21

SHA512
45726f8a46d94bb8327c58645981988ac2155c7b23aaf3915d28155968b1faf9823501f64e86f0e7c3b666635291c0d174b8fdd6c7849b2d910a055cee926515

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a6ede7fa0664c098ddf547d7b0162884

SHA1
4e3ebda792961b5d8adc76cacd0afeb05eb862ff

SHA256
1d19341964b97512bd9eba71833c7912306615651fca83bedba5c3d2b4a14f17

SHA512
2e330c772a29123d3e59d2a8338d67dbd6024bb087497f96f3964aabc1abde25f2f5ce82cb8e4f56019eb415e3b1ca6f04b6399265e378b5d915fc5b46bf09f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
50f1b96679badf170531458cc174d18b

SHA1
5dd37976acee6ff1de74ee0c67e14c9a6db69b49

SHA256
dd0271e4c5cb02bc8fe688c35da50729cb7622e6c350ac7e3e8c7fd5d3f0e571

SHA512
96fd94227148624fbfead1c467aec29dc344d144800e3623bb7e36e9a28fe250cb605469c65800801d1746c37fd1eea2c733bdeffeb9b1715ed0184fce176736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
31b9335dc2e0a26ad4b413ecb30880a2

SHA1
d5c0aeae713a1b8a41e39e362b6f27b36cf17537

SHA256
4d7924393365d1b8371ee4fac230dd766ad003e903665c3375d67f92c4a4d02b

SHA512
e34f90deccb6f7daba13e80a78aaa1f1902875bb6a4a44925eca202547513af6346ca70d9fad0271565a61517aae37d891b9305848e6beef57e629a511a9fd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
6f1047bfe2e8a79959c2a586fc61c7dc

SHA1
c83b59a7ecd50c5319816991bad9003bbfb1daa9

SHA256
5be9338f5fbed0cf940aee8b56bfa62c2e889c683a4e00cadc2a3771137e6404

SHA512
2c0e49b6153c50457c212d4393d439472ce47887fef630d833b95d1b1e21c0fd2d0aa1097a22cfdc94702e13f9af8da97cc0ae5b8498517ad075405aecf32658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b5a4.TMP

Filesize
707B

MD5
46eb86c05d97e221b58dcf96a2aedd05

SHA1
811323449bf7be06271dfef66ab14160df3ed3c2

SHA256
348d1e9c51e836694c723ef3a06e545be79111f7e04ec3a82748dbf06ba61364

SHA512
87dfbc8e19e798425988c6be324388074185a041c89fd9d39dc2a4e189b3d289717945db5d67f0dbb4f40a0aff7785628ae4aeb42fd7f1ece7698c6d7f854e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d96a0eab0d627be78ba8253d52a82f59

SHA1
a2668b0f3d15e78dc0050a11a696413fbcd3291d

SHA256
2aa9399d4181fef36b42a9c7418950c7c9760b08df7d1f1662ee573ad3b27c50

SHA512
63d16ee6cef1e61dc0796813d5ad8713112201a004ff0163b7ff2ff8f4dee5e36434838b2b62f440a76dd561f88598669705db21a3fd683cd19bf69017ac2ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f02d3006809ed144f7af629edc574eb

SHA1
be6b6414ce922df4f6df561ab321cb3a66989f7b

SHA256
c02376c7d1b2a433855950fcf7e2d4dd09b312f8ebb291837f59b5ecf8662498

SHA512
a9fde563685fcf82e22f2c58836673af5d6163a051ea56f203e90a05f6b70558675f7a5e3acb842200d29b5157154d97bd5c817f54d1779e04d4956d6808ad39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5765a65f1d0c82a08a0af84fef2d89eb

SHA1
f556b0f4a24abde5cac98c6befc6814eebbc5dab

SHA256
0155ace7be53ad84e3bccb5f3c403ec58552eb261ce8cde2d09793014da5d561

SHA512
0b8443dbd5365f98de61f7c166c34b5354fef850c56a8a1903b4a9a10d55fe2385e033b6d9357fe7be0396b5072cc486b3f6a3aa807d451e43a385a12955828c

Download Submit